One of Google’s Android partners turned 1.3 million set-top boxes into a botnet

Android TV devices and other IoT products now ship with a higher level of scrutiny, reducing the risk of pre-installed malware from manufacturers.

Google has revealed that one of its Android manufacturing partners, Shenzhen-based Videostrong Technology Co., secretly embedded a backdoor into 1.3 million devices, transforming them into a botnet. These devices, primarily Android TV set-top boxes but also including other IoT devices like telehealth devices and karaoke machines, were used without user knowledge for illicit activities including ad fraud, data exfiltration, and unauthorized network traffic routing. Google has since dismantled the backdoor, cut ties with Videostrong, and banned the company from building or selling certified Android devices. The manufacturer allegedly profited by selling access to the backdoor and deploying malware modules for criminal affiliates, which also impacted an estimated 10 million additional devices by disrupting their command and control domains. Google has stated that the malware was intentionally developed for financial gain and was integrated into various device models over multiple years using obfuscation techniques. The incident has prompted Google to revise its review processes for device manufacturers.

This incident highlights a significant vulnerability in the Android ecosystem, particularly concerning third-party manufacturers and the supply chain for IoT devices. The scale of the botnet, affecting over a million devices and leveraging them for financial gain through ad fraud and proxy services, demonstrates the potential for widespread compromise. Google's response, including cutting ties with the manufacturer and enhancing its review processes, signals a critical step toward tightening security protocols for its partners, potentially leading to increased development friction but ultimately a safer user experience.

The impact extends beyond the directly compromised devices, as Google's actions against the command and control domains disrupted access to an additional 10 million devices. This suggests a broad network of interconnected malicious activity orchestrated by the manufacturer and its affiliates. For consumers, it means that devices from less scrutinized manufacturers may pose a hidden risk, while for Google and its partners, it underscores the need for continuous vigilance and robust auditing mechanisms to prevent such sophisticated supply chain attacks from recurring in the future.